13:06 <david> Hey, In the past, Intel-based Macs allowed for active kernel debugging, but with the transition to Apple Silicon, developers are now limited to analyzing memory dumps, as outlined in the KDK (Kernel Debug Kit) README for two-machine debugging. Is this limitation on active kernel debugging in Apple Silicon systems the result of a software-level restriction, or does it stem from a

13:06 <david> hardware-level mitigation implemented in the new architecture? If it is a software level then what are the hacky way to achieve this?

14:25 <nickchan> david: it's a software restriction where some demotion registers (needed to enable debugging) disabled by boot ROM

14:26 <nickchan> the workaround for apple silicon mac would be to run to run macOS in hypervisor on m1n1

14:26 <nickchan> however, I think it has some compatibility problems and does not work for latest macOS

14:29 <nickchan> when not demoted I think coresight also doesn't work correctly

14:35 <sven> yeah, it partially works

14:36 <sven> iirc you can see PC but not much else

14:37 <nickchan> sven: that must be a recent addition

14:37 <nickchan> because ktrw on a11 *has* to work somehow

14:37 <nickchan> without demoting

14:44 <nickchan> sven: Don't think the exclaves stuff is deployed on macOS yet but after that happens running macOS in hypervisor is going to be... interesting to say at least

14:44 <nickchan> especially on m1

14:45 <nickchan> because with exclaves, sptm and txm macOS by default would have stuff in EL2, EL0, GL2, GL1(!) and GL0

14:46 <nickchan> can do nested on m2 at least but m1, uh idk

14:46 <nickchan> I expect m4 macs to get it so we should see soon

14:48 <chaos_princess> Is there a writeup on exclaves anywhere, cause eclecticlight's is kinda... light on the details.

14:52 <nickchan> chaos_princess: Exclave is its own little OS

14:52 <nickchan> cL4 kernel, runs in GL1, called exclaveCore

14:53 <nickchan> exclave userland is called exclaveOS, has a rootfs dmg, dyld, libsystem all that

14:53 <nickchan> I think it's like 230 MB in size at least for M4 iPad

14:53 <chaos_princess> how is it different from the old ppl/whatever it is called now?

14:54 <nickchan> chaos_princess: sptm is the ppl replacement

14:54 <nickchan> both runs in GL2

14:55 <nickchan> the kicker here is that Exclave is essentially SPTM's VM so to run it properly under m1n1 nested virt is required

14:55 <chaos_princess> no i mean, what extra stuff does the exclave thing do, compared to what gl2 did previously?

14:58 <nickchan> note: TXM runs in GL0 too, and in this sense TXM is SPTM's userland

14:59 <nickchan> chaos_princess: Don't think there's much research on that besides eclecticlight's blog